T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:58
- Finding
- Unverified Remote Installation Scripts Executed Directly by Shell Interpreters## Vulnerability Details **File Location**: `SKILL.md`, lines 58–62 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve mutable scripts from `cli.oomol.com` and immediately pass their contents to a command interpreter. The downloaded payload is not pinned to a specific version and is not verified using a cryptographic signature or published checksum before execution. Consequently, the code ultimately executed can differ from the content that existed when the Skill was audited. The `curl | bash` and `irm | iex` patterns also prevent meaningful review before execution. Although the domain is associated with the declared OOMOL CLI provider and installation is presented only as a fallback when `oo` is missing, trust in the hostname does not eliminate risks arising from a compromised server, deployment pipeline, CDN, DNS path, or provider account. This behavior exceeds the Skill's normal least-privilege boundary. Routine operation is limited to `Bash(oo *)` and read-only Stay AI connector actions, whereas these installation commands can execute arbitrary operating-system commands with all privileges available to the invoking process. The separate network transmission performed by `oo connector run` is consistent with the declared remote Stay AI connector functionality. The reviewed file does not demonstrate transmission of credentials to an unrelated service; it states that credentials are injected server-side. The confirmed issue is therefore the unverified remote execution channel, not the connector's necessary service traffic. ### Attack Path 1. The `oo` CLI is unavailable, causing the Agent or user to consult the first-time setup instru ...[truncated 1471 chars]
- Remediation
- ## Remediation Suggestions 1. Remove direct pipe-to-interpreter patterns such as `curl | bash` and `irm | iex`. 2. Prefer a trusted platform package manager or an authenticated official release artifact pinned to a specific version. 3. Download the installer to a local file without executing it immediately. 4. Publish and verify a cryptographic signature using a trusted, independently distributed public key. If signatures are unavailable, verify a version-specific checksum obtained through a separately authenticated channel. 5. Allow the user to inspect the downloaded file before execution and require explicit approval before running installation commands. 6. Execute the installer with the least-privileged account possible. Do not request administrator or root privileges unless a documented installation step strictly requires them. 7. Keep CLI installation outside normal Skill execution where possible. The Skill should report that the required dependency is missing and direct the user to verified installation documentation rather than autonomously executing an installer. 8. Pin the download to an immutable release rather than a mutable `install.sh` or `install.ps1` endpoint, and document the expected version and verification procedure.